What should an AI agent be allowed to do?

On this page

An AI agent needs enough authority to complete its task. That authority should describe the information it may access, the actions it may take and the money it may spend. Each is a separate business decision.

A service may be technically available to an agent while still being inappropriate for a particular job. A supplier-research agent might be allowed to retrieve public records, prepare a comparison and buy an approved report. Contacting suppliers or placing an order would create different commitments.

Defining those boundaries makes the useful part of autonomy concrete: the agent can move through an agreed piece of work without asking a person to approve every routine step.

Start with the result you are delegating

Consider an illustrative business preparing a shortlist of maintenance suppliers. The requested result is a comparison for the operations manager, including each supplier's stated capabilities, service area and sources.

The agent can choose which relevant public pages to inspect and whether an approved company-data service would resolve an ambiguity. It does not need permission to promise a contract, negotiate terms or send the business's internal maintenance records to every supplier it finds.

This is why a task description is more useful than a broad instruction to “act as our procurement agent”. It lets the business distinguish a helpful intermediate decision from a new commitment. The report’s definition of agentic work provides the wider frame for that distinction.

Separate three kinds of permission

Boundary	Example permission	Separate decision needed
Information	Read approved supplier information	Send internal documents to an outside service
Actions	Prepare a comparison for review	Email suppliers or change purchasing records
Spending	Buy a defined report within the task budget	Start a subscription or exceed the allowance

A single credential may expose more capabilities than the task needs. Ask the person connecting the service which operations that credential enables and where restrictions are enforced. The business policy should describe the permitted behaviour even when the underlying system groups several operations together.

Controls also need to survive the information the agent reads. A supplier webpage or returned document is evidence for the task; it is not a new instruction from the business granting permission to purchase something else. Build that distinction into the implementation and include misleading external instructions in the trial.

Permission needs a scope and an end

An approval is easier to apply when it identifies the agent or task, the allowed action, relevant conditions and expiry. An account balance alone supplies none of that context.

Google's Agent Payments Protocol introduction describes mandates that record a user's purchase instructions, including conditions for transactions made without the user present. It is a concrete approach to representing authority in a payment flow. It does not establish that every agent tool honours those conditions or that Agentic Economy implements the protocol.

For the supplier-shortlist example, permission might end when the comparison is delivered. If the manager then wants supplier outreach, that is another task with its own message and approval requirements. Keeping the transition explicit prevents a research assignment from silently becoming a negotiation.

Give the reviewer a real decision

Human review works best when the person can see what they are approving. “Continue?” is weak context for an unfamiliar purchase or external action.

A useful escalation states the proposed action, its purpose, the information that will leave the business, the cost and the consequence of declining. Where uncertainty caused the escalation, show it. For example: two similarly named companies were found and the agent cannot confidently identify the intended supplier.

The person can then approve a specific next step, correct the task or stop it. Design this handoff around decisions that matter. If every routine lookup needs a person, the system may transfer effort into supervision without improving the work.

Check outcomes before expanding autonomy

Review a completed trial against the result and the permission boundary. Did the comparison meet the brief? Did the agent stay within the allowed sources and spending? Did it pause at the intended points? What happened when a source was missing or a tool failed?

Keep evidence of the external actions and purchases needed to answer those questions. A convincing final document cannot tell you whether the agent sent an unauthorised message along the way.

Expand authority one useful boundary at a time, based on the task's observed behaviour. The report maps the relevant identity, authority and policy controls and the evaluation, observability and security layer. Agentic Economy is pre-launch; these are operating principles for planning agent work, not a claim that its account controls are available today.